GHSA-gx4c-2hqx-cw2r: Cleartext Transmission of Sensitive AWS STS Tokens in rclone S3 Backend via Scheme Downgrade Redirects
Vulnerability ID: GHSA-GX4C-2HQX-CW2R
CVSS Score: 3.1
Published: 2026-08-05
A logic vulnerability in the rclone S3 backend implementation allows an unauthenticated adjacent-network attacker to intercept temporary AWS STS credentials. During HTTP redirection handling, the application fails to verify whether a protocol scheme change occurred (such as transitioning from HTTPS to HTTP). If a secure request is redirected to an unencrypted endpoint on the same host, rclone continues to forward the highly sensitive X-Amz-Security-Token header in cleartext.
TL;DR
The rclone S3 backend does not strip the X-Amz-Security-Token header during HTTPS-to-HTTP redirects on the same host, exposing temporary session tokens to cleartext network sniffing by adjacent attackers.
Technical Details
- CWE ID: CWE-319
- Attack Vector: Adjacent Network
- CVSS v3.1 Score: 3.1
- Exploit Status: PoC (Unit Test Only)
- KEV Status: Not Listed
- Affected Component: backend/s3/s3.go
Affected Systems
- rclone S3 Backend
-
rclone: >= 1.74.3, < 1.74.4 (Fixed in:
1.74.4)
Code Analysis
Commit: 1a28451
backend/s3: strip AWS security token on scheme downgrade redirect
diff --git a/backend/s3/s3.go b/backend/s3/s3.go
index eb5e879c2a..a2da0a0b5e 100
--- a/backend/s3/s3.go
+++ b/backend/s3/s3.go
@@ -1370,13 +1370,13 @@ func s3RedirectCrossesHost(req *http.Request, via []*http.Request) bool {
if len(via) == 0 {
return false
}
- host := via[0].URL.Host
+ scheme, host := via[0].URL.Scheme, via[0].URL.Host
for _, redirect := range via[1:] {
- if redirect.URL.Host != host {
+ if redirect.URL.Host != host || redirect.URL.Scheme != scheme {
return true
}
}
- return host != req.URL.Host
+ return host != req.URL.Host || scheme != req.URL.Scheme
}
Exploit Details
- GitHub Security Advisory: Security advisory and analysis details including local reproduction scenarios.
Mitigation Strategies
- Upgrade the rclone client to version v1.74.4 or above.
- Enforce TLS-only communication at the storage endpoint ingress, disabling port 80 entirely.
- Implement HTTP Strict Transport Security (HSTS) on S3 storage endpoints.
Remediation Steps:
- Identify all production nodes running rclone utility versions below 1.74.4.
- Replace the binaries with compiled releases from version 1.74.4 or later.
- Audit self-hosted S3 proxy configurations (MinIO, Ceph, Nginx) to ensure they reject plaintext HTTP connections rather than redirecting to them.
- Minimize the expiration window of temporary AWS STS tokens in client profiles.
References
Read the full report for GHSA-GX4C-2HQX-CW2R on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)